Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added tests to tests/gh-actions to enable baseline and restricted PSS #2819

Merged
merged 6 commits into from
Aug 12, 2024
Merged

Added tests to tests/gh-actions to enable baseline and restricted PSS #2819

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
59280c5
Patched PSS labels to multi_tenancy
biswajit-9776 Jul 26, 2024
0355034
Added script in gh-actions to patch PSS/static/baseline/pacthes
biswajit-9776 Jul 30, 2024
74daa4e
Added PSS scripts for both baseline and restricted labels of static n…
biswajit-9776 Jul 30, 2024
3c31161
Added tests to enable PSS in gh-actions
biswajit-9776 Aug 5, 2024
93f8208
Added workflow test for PSS labels
biswajit-9776 Aug 9, 2024
f027248
Fixed indentation
biswajit-9776 Aug 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions tests/gh-actions/install_multi_tenancy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,6 @@ kustomize build common/kubeflow-roles/base | kubectl apply -f -

echo "Installing Multitenancy Network policies"
kustomize build common/networkpolicies/base | kubectl apply -f -

echo "Enabling restricted levels Pod Security Standards to kubeflow namespace"
kubectl patch namespace kubeflow --patch-file contrib/security/PSS/static/restricted/patches/kubeflow-labels.yaml
Copy link
Member

@juliusvonkohout juliusvonkohout Jul 30, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check if the namespace if it exists, if yes patch it. Start with baseline (static + dynamic) now and deal with restricted later in follow up PRs

Copy link
Member

@juliusvonkohout juliusvonkohout Jul 30, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The patch for the securitycontext of the profile controller belongs to /contrib/security/PSS/patches as well and needs to be applied here. And list the patches in example/kustomization.yaml

Loading